This objective requires your organization to identify all systems, applications, and infrastructure components that have the ability to generate audit records, especially those that process or support access to Controlled Unclassified Information (CUI).